CVE-2026-85569 — HIGH (7.2)

Vulnerability Description

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-269

References

https://wpscan.com/vulnerability/ddbae988-37a2-4fb7-a813-bbc708f1f1c9/

FAQ

What is CVE-2026-85569?

CVE-2026-85569 is a vulnerability with a CVSS score of 7.2 (HIGH). The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API cred...

How severe is CVE-2026-85569?

CVE-2026-85569 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-85569?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.